From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752536AbdAYVow (ORCPT ); Wed, 25 Jan 2017 16:44:52 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:41046 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752470AbdAYVou (ORCPT ); Wed, 25 Jan 2017 16:44:50 -0500 Message-ID: <1485380634.2998.161.camel@decadent.org.uk> Subject: Re: [PATCH 1/2] fs: Check f_cred instead of current's creds in should_remove_suid() From: Ben Hutchings To: Andy Lutomirski , security@kernel.org Cc: Konstantin Khlebnikov , Alexander Viro , Kees Cook , Willy Tarreau , "linux-mm@kvack.org" , Andrew Morton , yalin wang , Linux Kernel Mailing List , Jan Kara , Linux FS Devel , stable@vger.kernel.org Date: Wed, 25 Jan 2017 21:43:54 +0000 In-Reply-To: <9318903980969a0e378dab2de4d803397adcd3cc.1485377903.git.luto@kernel.org> References: <9318903980969a0e378dab2de4d803397adcd3cc.1485377903.git.luto@kernel.org> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-LW6dLfAszf3Gp4wHrYyw" X-Mailer: Evolution 3.22.3-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-LW6dLfAszf3Gp4wHrYyw Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2017-01-25 at 13:06 -0800, Andy Lutomirski wrote: > If an unprivileged program opens a setgid file for write and passes > the fd to a privileged program and the privileged program writes to > it, we currently fail to clear the setgid bit.=C2=A0=C2=A0Fix it by check= ing > f_cred instead of current's creds whenever a struct file is > involved. [...] What if, instead, a privileged program passes the fd to an un unprivileged program? It sounds like a bad idea to start with, but at least currently the unprivileged program is going to clear the setgid bit when it writes. This change would make that behaviour more dangerous. Perhaps there should be a capability check on both the current credentials and file credentials? (I realise that we've considered file credential checks to be sufficient elsewhere, but those cases involved virtual files with special semantics, where it's clearer that a privileged process should not pass them to an unprivileged process.) Ben. --=20 Ben Hutchings It is easier to write an incorrect program than to understand a correct one. --=-LW6dLfAszf3Gp4wHrYyw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAliJHBsACgkQ57/I7JWG EQn0NA/+OGkyAVJSb832BMVRKcL5nFM63tP0zcTG4i9lG8XrWcX5M9kpI3TrOKTI qjY+WHim3Px0EmveiomsjvJ3N2ND5sXBvUQr3uNHqPA+onWuhq0KfD12MzJowg1P zNJJ7kaXqAxRXMXcO58GmS7yBZXOjhUJLneWjIk3kSJzS125z4VuKXPk3d9j06Ah YKw1ESow2fC7qIlHGRe8PrddPQSmbxyXG6jrAjqKqOyQZ5loIzNVQbCQcJNCPy3F H1ETJdy1rzFswNZ7rASGyZ3y1QtVHPOWUMD4a2mkAGNZy3VC9GWpknV4xh5r+/jA uMahE3HuOSjzXQNI75NKn7gd6fdObY+U2tn09Tyrrz+qHWGs77F1fP+zYU9nslX2 ZH1ZumruCUPEkmqO7YQSTrpCWWuqumM5J3VZwrKGofJxOluJB2mb4dDxJzz3Ipd9 rxMNx2cwdVAYLub5TYJbkZJONhYJAvZHyauTDh5FuPB/MWQJSblHDxq9Vu+9jxge 73nkBq3sIOUY6sj8BYt9cwzPvL+OgfwGIIUP/nwL+dAfYvMQbmP0c0le59tFpJ2v r67GS/6M8QFusHTbUdGrXMciwB+IGq/xJ/YS6GqwkVamEHsLX1OP7cjdsqkEc6k4 dq3ND4rDGRtcT18hH46gMKYFp8A/5ol2MbRRHUWOsZIPVrylzWk= =q2V+ -----END PGP SIGNATURE----- --=-LW6dLfAszf3Gp4wHrYyw--